Broadcom Corporation

Suresh Krishna

Christopher Owen

Patrick Y Law

Derrick Chu Lin

Joseph John Tardo

Phillip Smith

Provided is an architecture for a cryptography accelerator chip that allows significant performance improvements over previous prior art designs. In various embodiments, the architecture enables parallel processing of packets through a plurality of cryptography engines and includes a classification engine configured to efficiently process encryption/decryption of data packets. Cryptography acceleration chips in accordance may be incorporated on network line cards or service modules and used in applications as diverse as connecting a single computer to a WAN, to large corporate networks, to networks servicing wide geographic areas (e.g., cities). The present invention provides improved performance over the prior art designs, with much reduced local memory requirements, in some cases requiring no additional external memory. In some embodiments, the present invention enables sustained full duplex Gigabit rate security processing of IPSec protocol data packets.

Classification engine in a cryptography acceleration chip

Distributed processing in a cryptography acceleration chip

An architecture and a method for cryptography acceleration is disclosed that allows significant performance improvements without the use of external memory. Specifically, the chip architecture enables 'cell-based' processing of random-length IP packets. The IP packets, which may be of variable and unknown size, are split into fixed size 'cells.' The fixed-size cells are then processed and reassembled into packets. The cell-based packet processing architeture of the present invention allows the implementation of a processing pipeline that has known processing throughput and timing characteristics, thus making it possible to fetch and process the cells in a predictable time frame. The architecture is scalable and is also independent of the type of cryptography performed. The cells may be fetched ahead of time (pre-fetched) and the pipeline may be staged in such a manner that attached (local) memory is not required to store packet or control parameters.

Security chip architecture and implementations for cryptography acceleration

An architecture and a method for a cryptography acceleration is disclosed that allows significant performance improvements without the use of external memory. Specifically, the chip architecture enables 'cell-based' processing of random-length IP packets. The IP packets, which may be of variable and unknown size, are split into fixed-size 'cells.' The fixed-sized cells are then processed and reassembled into packets. The cell-based packet processing architecture of the present invention allows the implementation of a processing pipeline that has known processing throughput and timing characteristics, thus making it possible to fetch and process the cells in a predictable time frame. The architecture is scalable and is also independent of the type of cryptography performed. The cells may be fetched ahead of time (pre-fetched) and the pipeline may be staged in such a manner that attached (local) memory is not required to store packet data or control parameters.

An architecture and a method for a cryptography acceleration is disclosed that allows significant performance improvements without the use of external memory. Specifically, the chip architecture enables &ldquo;cell-based&rdquo; processing of random-length IP packets. The IP packets, which may be of variable and unknown size, are split into fixed-size &ldquo;cells.&rdquo; The fixed-sized cells are then processed and reassembled into packets. The cell-based packet processing architecture of the present invention allows the implementation of a processing pipeline that has known processing throughput and timing characteristics, thus making it possible to fetch and process the cells in a predictable time frame. The architecture is scalable and is also independent of the type of cryptography performed. The cells may be fetched ahead of time (pre-fetched) and the pipeline may be staged in such a manner that attached (local) memory is not required to store packet data or control parameters.

Growing community of inventors

Sunnyvale, CA, United States of America

Suresh Krishna